Cyber Trackr - Free Compliance Library
Cyber Trackr
The Free Compliance Library

VMware NSX 4.x Tier-0 Gateway Firewall Security Technical Implementation Guide

  • Version/Release: V1R1
  • Published: 2024-07-26
  • Released: 2024-08-07
  • Expand All:
  • Severity:
  • Sort:
Compare

Select any two versions of this STIG to compare the individual requirements

View

Select any old version/release of this STIG to view the previous requirements

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.
b
The NSX Tier-0 Gateway Firewall must generate traffic log entries.
AU-3 - Medium - CCI-000130 - V-263278 - SV-263278r977601_rule
RMF Control
AU-3
Severity
Medium
CCI
CCI-000130
Version
NT0F-4X-000004
Vuln IDs
  • V-263278
Rule IDs
  • SV-263278r977601_rule
Without establishing what type of event occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. Audit event content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. Associating event types with detected events in the network element logs provides a means of investigating an attack, recognizing resource usage or capacity thresholds, or identifying an improperly configured network element.
Checks: C-67178r977599_chk

If the Tier-0 Gateway is deployed in an Active/Active HA mode and no stateless rules exist, this is Not Applicable. From the NSX Manager web interface, go to Security >> Policy Management >> Gateway Firewall >> Gateway Specific Rules. For each Tier-0 Gateway and for each rule, click the gear icon and verify the logging setting. If logging is not enabled, this is a finding.

Fix: F-67086r977600_fix

From the NSX Manager web interface, go to Security >> Policy Management >> Gateway Firewall >> Gateway Specific Rules. For each Tier-0 Gateway and for each rule with logging disabled, click the gear icon, enable logging, and then click "Apply". After all changes are made, click "Publish".

c
The NSX Tier-0 Gateway Firewall must manage excess bandwidth to limit the effects of packet flooding types of denial-of-service (DoS) attacks.
SC-5 - High - CCI-001095 - V-263279 - SV-263279r977604_rule
RMF Control
SC-5
Severity
High
CCI
CCI-001095
Version
NT0F-4X-000015
Vuln IDs
  • V-263279
Rule IDs
  • SV-263279r977604_rule
A firewall experiencing a DoS attack will not be able to handle production traffic load. The high usage and CPU caused by a DoS attack will also have an effect on control keep-alives and timers used for neighbor peering resulting in route flapping and will eventually black hole production traffic. The device must be configured to contain and limit a DoS attack's effect on the device's resource usage. The use of redundant components and load balancing are examples of mitigating "flood-type" DoS attacks through increased capacity.
Checks: C-67179r977602_chk

If the Tier-0 Gateway is deployed in an Active/Active HA mode and no stateless rules exist, this is Not Applicable. From the NSX Manager web interface, go to Security >> Settings >> General Settings >> Firewall >> Flood Protection to view Flood Protection profiles. If there are no Flood Protection profiles of type "Gateway", this is a finding. For each gateway flood protection profile, if TCP Half Open Connection limit, UDP Active Flow Limit, ICMP Active Flow Limit, and Other Active Connection Limit are set to "None", this is a finding. For each gateway flood protection profile, examine the "Applied To" field to view the Tier-0 Gateways to which it is applied. If a gateway flood protection profile is not applied to all applicable Tier-0 Gateways through one or more policies, this is a finding.

Fix: F-67087r977603_fix

To create a new Flood Protection profile, do the following: From the NSX Manager web interface, go to Security >> Settings >> General Settings >> Firewall >> Flood Protection >> Add Profile >> Add Edge Gateway Profile. Enter a name and specify appropriate values for the following: TCP Half Open Connection limit, UDP Active Flow Limit, ICMP Active Flow Limit, and Other Active Connection Limit. Configure the "Applied To" field to contain Tier-0 Gateways, and then click "Save".

b
The NSX Tier-0 Gateway Firewall must deny network communications traffic by default and allow network communications traffic by exception.
SC-7 - Medium - CCI-001109 - V-263280 - SV-263280r977607_rule
RMF Control
SC-7
Severity
Medium
CCI
CCI-001109
Version
NT0F-4X-000016
Vuln IDs
  • V-263280
Rule IDs
  • SV-263280r977607_rule
To prevent malicious or accidental leakage of traffic, organizations must implement a deny-by-default security posture at the network perimeter. Such rulesets prevent many malicious exploits or accidental leakage by restricting the traffic to only known sources and only those ports, protocols, or services that are permitted and operationally necessary. As a managed boundary interface, the firewall must block all inbound and outbound network traffic unless a filter is installed to explicitly allow it. The allow filters must comply with the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and Vulnerability Assessment (VA).
Checks: C-67180r977605_chk

From the NSX Manager web interface, go to Security >> Policy Management >> Gateway Firewall >> Gateway Specific Rules. Choose each Tier-0 Gateway in drop-down, then select Policy_Default_Infra Section >> Action. If the default_rule is set to "Allow", this is a finding.

Fix: F-67088r977606_fix

From the NSX Manager web interface, go to Security >> Policy Management >> Gateway Firewall >> Gateway Specific Rules. Choose each Tier-0 Gateway in drop-down, then select Policy_Default_Infra Section >> Action. Change the Action to "Drop" or "Reject", and then click "Publish".

b
The NSX Tier-0 Gateway Firewall must be configured to send traffic log entries to a central audit server.
AU-4 - Medium - CCI-001851 - V-263281 - SV-263281r1000971_rule
RMF Control
AU-4
Severity
Medium
CCI
CCI-001851
Version
NT0F-4X-000020
Vuln IDs
  • V-263281
Rule IDs
  • SV-263281r1000971_rule
Without the ability to centrally manage the content captured in the traffic log entries, identification, troubleshooting, and correlation of suspicious behavior would be difficult and could lead to a delayed or incomplete analysis of an ongoing attack. The DOD requires centralized management of all network component audit record content. Network components requiring centralized traffic log management must have the ability to support centralized management. The content captured in traffic log entries must be managed from a central location (necessitating automation). Centralized management of traffic log records and logs provides for efficiency in maintenance and management of records, as well as the backup and archiving of those records. Ensure at least one syslog server is configured on the firewall. If the product inherently has the ability to store log records locally, the local log must also be secured. However, this requirement is not met since it calls for a use of a central audit server.
Checks: C-67181r977608_chk

From an NSX Edge Node shell hosting the Tier-0 Gateway, run the following command: > get logging-servers Note: This check must be run from each NSX Edge Node hosting a Tier-0 Gateway, as they are configured individually. or If Node Profiles are used, from the NSX Manager web interface, go to System >> Configuration >> Fabric >> Profiles >> Node Profiles. Click "All NSX Nodes" and verify the syslog servers listed. If any configured logging servers are configured with a protocol of "udp", this is a finding. If any logging servers are not configured with a level of "info", this is a finding. If no logging servers are configured, this is a finding.

Fix: F-67089r1000971_fix

To configure a profile to apply syslog servers to all NSX Edge Nodes, do the following: From the NSX Manager web interface, go to System >> Configuration >> Fabric >> Profiles >> Node Profiles. Click "All NSX Nodes" and then under "Syslog Servers" click "Add". Enter the syslog server details and choose "Information" for the log level and click "Add". or (Optional) From an NSX Edge Node shell, run the following command to clear any existing incorrect logging servers: > clear logging-servers From an NSX Edge Node shell, run the following command to configure a TCP syslog server: > set logging-server <server-ip or server-name> proto tcp level info From an NSX Edge Node shell, run the following command to configure a primary and backup TLS syslog server: > set logging-server <server-ip or server-name> proto tls level info serverca ca.pem clientca ca.pem certificate cert.pem key key.pem From an NSX Edge Node shell, run the following command to configure a LI-TLS syslog server: > set logging-server <server-ip or server-name> proto li-tls level info serverca root-ca.crt Note: If using the protocols TLS or LI-TLS to configure a secure connection to a log server, the server and client certificates must be stored in /var/vmware/nsx/file-store/ on each NSX Edge Node appliance. Note: Configure the syslog or SNMP server to send an alert if the events server is unable to receive events from the NSX-T and also if denial of service (DoS) incidents are detected. This is true if the events server is STIG compliant.